Log in Request a demo

Malware profile

Candiru spyware

Also known as Integrity Labs, Saito Tech Ltd.

Candiru spyware is surveillance software made by Candiru, an Israeli company that the Citizen Lab says sells spyware only to governments.

In short

Candiru spyware is surveillance software made by Candiru, an Israeli company that the Citizen Lab says sells spyware only to governments. In October 2026 the Citizen Lab said, with high confidence, that this spyware infected devices at an international news network through targeted online ads that needed no click.

Last updated 19 October 2026

Profile MapMalware
  1. Names6names in public reportsCandiru · Integrity Labs · Saito Tech Ltd.
  2. Infection Steps5in the delivery chainTarget picked · Ad shown

In one minute

What it is
Spyware sold by the Israeli company Candiru, which the Citizen Lab says sells only to governments. The US Commerce Department put Candiru on its Entity List in November 2021.
What it does
In the Citizen Lab's 2021 analysis, the Windows spyware took files, exported Signal messages, stole browser cookies and passwords, and could send messages from logged in accounts.
Who uses it
Attributed by the Citizen Lab (15 October 2026, high confidence) to Candiru, in zero-click attacks on at least 45 devices at an international news network in 2024 and 2025.
How it gets in
Targeted online ads served through Discover-Tech's Controlium platform, where showing the ad was enough. Earlier, the Citizen Lab found Candiru servers posing as trusted websites.
What to do first
Block ads at the network gateway and on work devices, and turn off unique advertising IDs on managed phones, as the Citizen Lab advises.

What it does

The Citizen Lab recovered a copy of Candiru’s Windows spyware in 2021. It found the spyware could take files and export messages from the Windows version of Signal. It could also steal cookies and passwords from major browsers and send messages from logged in email and social media accounts.

A Windows DLL isolated from one of the compromised devices at a news network broadly overlaps in function with that older chain, the Citizen Lab says. Both samples stay on the machine through a COM hijack. The 2026 case is described on our page about the AdFection attacks through online ads, and the wider market is explained under mercenary spyware.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
CandiruName of the company and its spyware in Citizen Lab reports of 2021 and 2026, and in the US Entity List rule[1, 3, 5]
Integrity LabsThe Citizen Lab calls Integrity Labs the rebranded Candiru (2026)[1]
Saito Tech Ltd.Company name in the Citizen Lab 2021 report and an alias in the Entity List rule[3, 5]
Taveta Ltd.Earlier company name (Citizen Lab 2021) and an alias in the Entity List rule[3, 5]
Grindavik Solutions Ltd.Earlier company name (Citizen Lab 2021) and an alias in the Entity List rule[3, 5]
DF Associates Ltd.Earlier company name (Citizen Lab 2021) and an alias in the Entity List rule[3, 5]

How it spreads

In the attacks of 2024 and 2025 the spyware arrived through online ads. Discover-Tech, an Israeli company, ran a platform called Controlium. The Citizen Lab says its customers could pick one person by mobile advertising ID, browser cookie or IP address. When the ad showed on that device, it ran JavaScript that could load more code, such as a browser exploit. The Citizen Lab says the simple display of a targeted ad was enough for infection. In 2021 it found Candiru servers posing as websites of advocacy groups, media outlets and international bodies.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Target picked

    A customer selects one person in Controlium by mobile advertising ID, browser cookie or IP address.[1]

  2. Ad shown

    A normal looking ad appears on the person's device. The ad itself does not carry the exploit.[1, 2]

  3. Device checked

    The ad identifier and IP address go to Discover-Tech servers, and the device is checked and profiled.[1, 2]

  4. Code delivered

    Malicious JavaScript runs in the browser or app and can load more code, such as a browser exploit.[1, 2]

  5. Spyware in place

    The spyware contacts its command and control server. On Windows it stays through a COM hijack.[1]

Timeline

  1. 2014

    Company founded

    The Citizen Lab says Candiru Ltd. was founded in 2014 and is based in Tel Aviv.[3]

  2. 15 July 2021

    First Citizen Lab report

    The Citizen Lab publishes Hooking Candiru, with an analysis of the company's Windows spyware and its servers.[3]

  3. 3 November 2021

    Windows flaws listed

    CISA adds CVE-2021-31979 and CVE-2021-33771, two Windows kernel privilege escalation flaws, to its Known Exploited Vulnerabilities Catalog. The Citizen Lab ties both to the Candiru work of 2021.[3, 6]

  4. 4 November 2021

    US Entity List

    The US Commerce Department adds Candiru to the Entity List for developing and supplying spyware to foreign governments.[4, 5]

  5. 2024 and 2025

    Attacks through ads

    At least 45 devices at an international news network are targeted in zero-click attacks through ads, the Citizen Lab says.[1]

  6. March to June 2026

    Ads seen at scale

    Discover-Tech ads appear in over 70,000 mobile apps and over 120,000 websites.[1]

  7. Early October 2026

    Ad vendor cut off

    An ad exchange that worked with the researchers ends Discover-Tech's access, and IAB Europe removes it from its vendor list.[1]

  8. 15 October 2026

    AdFection report

    The Citizen Lab publishes its report and attributes the spyware used in these attacks to Candiru with high confidence.[1, 2]

Detection and defense

  1. Block ads at the edge

    Block ads at your organisation's gateway and on work issued and edge devices, as the Citizen Lab advises. MITRE also lists ad blockers as a mitigation for drive-by compromise.[1, 7]

    Counters: T1189

  2. Turn off advertising IDs

    Disable unique advertising IDs on managed phones through device management, and opt company devices out of ad targeting.[1]

    Counters: T1189

  3. Choose safer browsers

    Move staff to browsers with built in anti-tracking, ad blocking and support for Global Privacy Control.[1]

    Counters: T1189

  4. Patch and sandbox

    Keep browsers and plugins updated and use browser sandboxing, as MITRE advises. Patch the two Windows flaws from the 2021 chain that CISA lists.[6, 7]

    Counters: T1189 T1068

  5. Watch ad traffic

    Monitor traffic linked to ad impressions for signs of malicious requests, as the Citizen Lab recommends.[1]

    Counters: T1189

  6. Know what is published

    We found no government advisory with detection signatures for Candiru spyware. The Citizen Lab reports carry the technical details.[1, 3]

Questions

What is Candiru spyware?

Surveillance software made by the Israeli company Candiru. The Citizen Lab's 2021 analysis found the Windows version could take files, export Signal messages and steal browser passwords.

Who makes it?

Candiru, which the Citizen Lab says was founded in 2014 and sells spyware only to governments. The Citizen Lab calls Integrity Labs the rebranded Candiru.

How did it reach devices in 2024 and 2025?

Through targeted online ads served by Discover-Tech's Controlium platform. The Citizen Lab says showing the ad was enough, so no click was needed.

Why is Candiru on the US Entity List?

The Commerce Department said Candiru developed and supplied spyware to foreign governments that used it against officials, journalists, activists, academics and embassy workers.

Does seeing a Discover-Tech ad mean a device is infected?

No. The Citizen Lab says an ad impression does not by itself confirm targeting or infection.

In our research

  1. Mercenary spyware Glossary term

Sources

  1. Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware The Citizen LabSupports: 2026 attribution, Controlium targeting, Windows DLL and COM hijack, scale of ads, recommendations
  2. Exposing AdFection Executive Summary The Citizen LabSupports: Publication on 15 October 2026, first public confirmation, ads carry no exploit, ad impression caveat
  3. Hooking Candiru: Another Mercenary Spyware Vendor Comes into Focus The Citizen LabSupports: Company history and names, Windows spyware abilities, COM hijack, servers posing as trusted sites
  4. Commerce Adds NSO Group and Other Foreign Companies to Entity List for Malicious Cyber Activities US Bureau of Industry and SecuritySupports: Listing on 4 November 2021 and its reason
  5. Addition of Certain Entities to the Entity List (2021-24123) Federal Register, US Department of CommerceSupports: Seven aliases of Candiru and the presumption of denial
  6. Known Exploited Vulnerabilities Catalog CISASupports: CVE-2021-31979 and CVE-2021-33771 added on 3 November 2021
  7. Drive-by Compromise, T1189 MITRE ATT&CKSupports: Malicious ads as a delivery route, mitigations for ad blocking, updates and sandboxing

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Mercenary spyware

Mercenary spyware is surveillance software that a private company builds and sells, usually to governments, to take over a person's phone or computer in secret.

Read more

Glossary term

Command and control (C2)

Command and control (C2) is how an attacker communicates with systems they have compromised in order to control them.

Read more

Technique

Drive-by Compromise

Drive-by Compromise is a way for attackers to gain access to a computer when a person visits a website during normal browsing.

Read more

Technique

Exploitation for Privilege Escalation

Exploitation for privilege escalation is when an attacker uses a flaw in software to gain higher permissions than they started with.

Read more